General
- Target 2026-07-17_31f3ab1411e8379eee8acb0a12cd5c09_blankgrabber_coinminer_icedid_luca-stealer_njrat
- Size 6.8MB
- Sample260717-3d4yaacy61
- SHA256 392493f3a2e87f9c4d87b08d6416e602d4a1daab187b739e7cbe1730df640d75
- MD5 31f3ab1411e8379eee8acb0a12cd5c09
- SHA1 69c2aec65fc6a2c64ab9024791c835b6c13b914b
- SHA512 8620e450abf6b8eebabfebd68ac33fed50309fb411a7d0105132f22d26f13b378b05bc797006a55783cb006f9d1d000bfbb56f6fd5a98f7d3b14a8da9eece145
- SSDEEP 196608:bx/uDMHDGv+KqKztgNRq8X5/ssLtf/R1R5:FGYHD5K1wRq8p/ssLtB7
- TLSH T145663359F2D90EFCE41B863EE09A5B8BD725BC520341538B0370295D8E1B6A06F3BB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_31f3ab1411e8379eee8acb0a12cd5c09_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_31f3ab1411e8379eee8acb0a12cd5c09_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-17_31f3ab1411e8379eee8acb0a12cd5c09_blankgrabber_coinminer_icedid_luca-stealer_njrat
- Size 6.8MB
- SHA256 392493f3a2e87f9c4d87b08d6416e602d4a1daab187b739e7cbe1730df640d75
- MD5 31f3ab1411e8379eee8acb0a12cd5c09
- SHA1 69c2aec65fc6a2c64ab9024791c835b6c13b914b
- SHA512 8620e450abf6b8eebabfebd68ac33fed50309fb411a7d0105132f22d26f13b378b05bc797006a55783cb006f9d1d000bfbb56f6fd5a98f7d3b14a8da9eece145
- SSDEEP 196608:bx/uDMHDGv+KqKztgNRq8X5/ssLtf/R1R5:FGYHD5K1wRq8p/ssLtB7
- TLSH T145663359F2D90EFCE41B863EE09A5B8BD725BC520341538B0370295D8E1B6A06F3BB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables Discord URL observed in first stage droppers
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.